https://blog.margrop.net/en/tag/ai-gateway/ Recent content in AI Gateway on Margrop Blog Hugo en-US Fri, 10 Jul 2026 15:30:00 +0800 https://blog.margrop.net/en/post/newapi-self-hosted-relay-station/ Fri, 10 Jul 2026 15:30:00 +0800 https://blog.margrop.net/en/post/newapi-self-hosted-relay-station/ <blockquote> <p><strong>TL;DR</strong></p> <p>NewAPI is not a free-model trick and it is not a mysterious proxy. In my setup, it is the front desk for AI usage: every app talks to one endpoint, while the gateway routes requests to authorized upstream providers and handles tokens, quotas, groups, model limits, logs, and usage accounting. For a personal deployment, the big win is not “one more dashboard”; it is no longer scattering upstream keys across every client, script, and agent.</p> <p>This post explains why I wanted a self-hosted model relay, what people usually misunderstand, how to deploy a minimal Docker Compose version, why I add persistent storage, and how to use one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26. It also includes an agent-driven setup prompt with strict boundaries. No private address, complete machine name, private domain, or real secret is included.</p> </blockquote> https://blog.margrop.net/en/post/openclaw-missing-operator-write-scope/ Fri, 10 Jul 2026 08:00:00 +0800 https://blog.margrop.net/en/post/openclaw-missing-operator-write-scope/ <p>This incident looked like a model-provider outage at first. OpenClaw had just received three NewAPI-backed fallback models, but gateway-based model calls started failing with a provider authentication error. After peeling back the outer message, the real error was much more specific:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>missing scope: operator.write </span></span></code></pre></div><p>That string changed the direction of the investigation. The provider key was not the root problem. The NewAPI endpoint was not the root problem. The model names were not the root problem either. The failure lived inside OpenClaw&rsquo;s gateway authorization path: when a model override was used, the gateway call switched into a backend/gateway-client mode, but did not force the request to use the already paired stored device identity. The device had <code>operator.write</code>; the request simply did not carry the identity that could prove it.</p> <p>The shortest version is this: <strong>the badge existed, but this entrance did not scan it.</strong></p> <p><img src="https://blog.margrop.net/post-images/openclaw-missing-operator-write-scope/cover.png" alt="AI-generated cover showing a gateway protected by two authorization locks"></p>